Page 1 Huawei AR1200 Series Enterprise Routers V200R001C00 Configuration Guide - Basic Configuration Issue Date 2012-05-15 HUAWEI TECHNOLOGIES CO., LTD.
Page 2 All other trademarks and trade names mentioned in this document are the property of their respective holders. Notice The purchased products, services and features are stipulated by the contract made between Huawei and the customer. All or part of the products, services and features described in this document may not be within the purchase scope or the usage scope.
Page 3: About This Document
Huawei AR1200 Series Enterprise Routers Configuration Guide - Basic Configuration About This Document About This Document Intended Audience This document provides the basic concepts, configuration procedures, and configuration examples in different application scenarios of the Basic configuration supported by the AR1200 device.
Page 4 Huawei AR1200 Series Enterprise Routers Configuration Guide - Basic Configuration About This Document Command Conventions The command conventions that may be found in this document are defined as follows. Convention Description Boldface The keywords of a command line are in boldface.
Page 5 Huawei AR1200 Series Enterprise Routers Configuration Guide - Basic Configuration About This Document The following information is modified: 1.2.3 Logging In to the Device 9.3.6 (Optional) Upgrading the BootROM of the LPU Changes in Issue 02 (2011-06-25) Based on issue 01 (2011-03-30), the document is updated as follows: The following information is modified: 1.2 Logging In to the Device Through the Console Port...
Page 6: Table Of Contents
Huawei AR1200 Series Enterprise Routers Configuration Guide - Basic Configuration Contents Contents About This Document........................ii 1 Logging In to the System for the First Time................1 1.1 Introduction................................2 1.2 Logging In to the Device Through the Console Port..................2 1.2.1 Establishing the Configuration Task......................2 1.2.2 Establishing the Physical Connection......................3...
Page 7 Huawei AR1200 Series Enterprise Routers Configuration Guide - Basic Configuration Contents 2.5.2 Example for Using Shortcut Keys......................29 3 Basic Configuration........................30 3.1 Configuring the Basic System Environment....................31 3.1.1 Establishing the Configuration Task.......................31 3.1.2 Configuring the Equipment Name......................31 3.1.3 Setting the System Clock.........................32 3.1.4 Configuring a Header..........................38...
Page 8 Huawei AR1200 Series Enterprise Routers Configuration Guide - Basic Configuration Contents 5.1 Overview of User Login...........................70 5.2 Logging in to the Devices Through the Console Port..................72 5.2.1 Establishing the Configuration Task.......................72 5.2.2 Logging In to the Device Using a Console Port..................73 5.2.3 (Optional) Configuring the Console User Interface................75...
Page 9 Huawei AR1200 Series Enterprise Routers Configuration Guide - Basic Configuration Contents 6.3.3 (Optional) Specifying a Port Number for the FTP Server..............111 6.3.4 Enabling the FTP Server........................112 6.3.5 (Optional) Configuring the FTP Server Parameters................112 6.3.6 (Optional) Configuring an FTP ACL....................113 6.3.7 Accessing the System by Using FTP.....................114 6.3.8 Managing Files Using FTP Commands....................115...
Page 10 Huawei AR1200 Series Enterprise Routers Configuration Guide - Basic Configuration Contents 8.1.4 SSH Method............................146 8.2 Logging in to Other Devices Using Telnet.....................147 8.2.1 Establishing the Configuration Task.....................147 8.2.2 (Optional) Configuring a Source IP Address for a Telnet Client............148 8.2.3 Logging in to Another Device by Using Telnet..................149 8.2.4 Checking the Configuration........................149...
Page 11 Huawei AR1200 Series Enterprise Routers Configuration Guide - Basic Configuration Contents 8.7.4 Example for Connecting the SFTP Client to the SSH Server...............178 8.7.5 Example for Authenticating SSH Through RADIUS................182 9 Upgrade and Maintenance.......................188 9.1 Upgrade and Maintenance Overview......................189 9.1.1 License Authorization..........................189 9.1.2 Software Upgrade..........................189...
Page 12 Huawei AR1200 Series Enterprise Routers Configuration Guide - Basic Configuration Contents 9.7.1 Example for Upgrading System Software.....................215 9.7.2 Example for Installing a Patch File.......................219 Issue 04 (2012-05-15) Huawei Proprietary and Confidential Copyright © Huawei Technologies Co., Ltd.
Page 13: Logging In To The System For The First Time
Huawei AR1200 Series Enterprise Routers Configuration Guide - Basic Configuration 1 Logging In to the System for the First Time Logging In to the System for the First Time About This Chapter You can log in to a new router through the console port or mini USB port to configure the router.
Page 14: Introduction
Huawei AR1200 Series Enterprise Routers Configuration Guide - Basic Configuration 1 Logging In to the System for the First Time 1.1 Introduction You can configure a device that is powered on for the first time by logging in through the console port or mini USB port.
Page 15: Establishing The Physical Connection
Huawei AR1200 Series Enterprise Routers Configuration Guide - Basic Configuration 1 Logging In to the System for the First Time Data Terminal communication parameters l Baud rate l Data bit l Parity l Stop bit l Flow-control mode NOTE The system automatically uses default parameter values for the first login.
Page 16 Huawei AR1200 Series Enterprise Routers Configuration Guide - Basic Configuration 1 Logging In to the System for the First Time Figure 1-1 Connection creation Step 2 Set an interface, as shown in Figure 1-2. Figure 1-2 Interface settings Step 3 Set communication parameters to match the router defaults, as shown in Figure 1-3.
Page 17: Logging In To The Router Through A Mini Usb Port
Configuration Guide - Basic Configuration 1 Logging In to the System for the First Time Figure 1-3 Communication parameter settings Step 4 Press Enter. A command-line prompt such as <Huawei> appears, and the user view is displayed for you to configure the router. NOTE When you connect to the console port of a AR1200 that does not have a startup configuration file, the system displays "Auto-Config is working.
Page 18: Establishing The Configuration Task
Huawei AR1200 Series Enterprise Routers Configuration Guide - Basic Configuration 1 Logging In to the System for the First Time 1.3.1 Establishing the Configuration Task Before logging in to the router through a mini USB port, familiarize yourself with the applicable environment, complete the pre-configuration tasks, and obtain the data required for the configuration.
Page 19 Huawei AR1200 Series Enterprise Routers Configuration Guide - Basic Configuration 1 Logging In to the System for the First Time NOTE Visit http://support.huawei.com and choose Software Center > Version Software > Data Communication Product Line > Router > AR1200&2200&3200>AR1200>AR1200 V200R001C01SPC200 to download AR_MiniUSB_driver_1_0.
Page 20 Huawei AR1200 Series Enterprise Routers Configuration Guide - Basic Configuration 1 Logging In to the System for the First Time Figure 1-5 Accepting the terms in the license agreement Step 3 Click Change to change the driver directory, and click Next, as shown in Figure 1-6.
Page 21 Huawei AR1200 Series Enterprise Routers Configuration Guide - Basic Configuration 1 Logging In to the System for the First Time Figure 1-6 Specifying the driver directory Step 4 Click Install and decompress the driver. When the system finishes decompressing the driver,...
Page 22: Logging In To The Router
Huawei AR1200 Series Enterprise Routers Configuration Guide - Basic Configuration 1 Logging In to the System for the First Time Figure 1-7 Finishing decompressing the driver Step 5 Find the DISK1 folder in the specified driver directory, and double-click setup.exe.
Page 23 Huawei AR1200 Series Enterprise Routers Configuration Guide - Basic Configuration 1 Logging In to the System for the First Time Figure 1-8 Establishing a connection Step 2 Specify a connection port. If the connection port is a mini USB port, select COM3, as shown Figure 1-9.
Page 24 Huawei AR1200 Series Enterprise Routers Configuration Guide - Basic Configuration 1 Logging In to the System for the First Time Figure 1-10 Setting communication parameters Step 4 Press Enter on the subsequent dialog boxes until the command line prompt of the user view, such as <Huawei>, is displayed.
Page 25: Cli Overview
Huawei AR1200 Series Enterprise Routers Configuration Guide - Basic Configuration 2 CLI Overview CLI Overview About This Chapter The command line interface (CLI) is used to configure and maintain devices. 2.1 CLI Introduction After you log in to the router, a prompt is displayed and you can use the command line interface (CLI).
Page 26: Cli Introduction
Huawei AR1200 Series Enterprise Routers Configuration Guide - Basic Configuration 2 CLI Overview 2.1 CLI Introduction After you log in to the router, a prompt is displayed and you can use the command line interface (CLI). Users can interact with the router through the CLI.
Page 27 Huawei AR1200 Series Enterprise Routers Configuration Guide - Basic Configuration 2 CLI Overview By default, the command level of a user is a value ranging from 0 to 3, and the user access level is a value ranging from 0 to 15.
Page 28 Huawei AR1200 Series Enterprise Routers Configuration Guide - Basic Configuration 2 CLI Overview Figure 2-1 Entering the search window Enter the command level you want in the "Type in the word(s) to search for" textbox and click "List Topics". All commands of the specified level will be displayed as shown in Figure 2-2.
Page 29: Command Line Views
The following example uses the user, system, and aaa views: # Establish a connection to the router. If the router is using the default configurations, the <Huawei> prompt indicates that you have entered the user view. <Huawei> # Run the system-view command to enter the system view.
Page 30: Online Help
NOTE The command prompt "Huawei" is the default host name. The prompt indicates a specific view. For example, "Huawei" indicates the user view, and "[HUAWEI-ui-console0]" indicates the console user interface view. Some commands can be used in more than one view, but their effects vary from view to view.
Page 31: Partial Help
Huawei AR1200 Series Enterprise Routers Configuration Guide - Basic Configuration 2 CLI Overview the parameter sets. A display of <cr> indicates that no parameters are associated with this command. The command is repeated in the next command line. You can press Enter to run the command.
Page 32: Cli Features
Huawei AR1200 Series Enterprise Routers Configuration Guide - Basic Configuration 2 CLI Overview Table 2-2 Common error messages of the command line Error messages Cause of the error Error: Unrecognized command The command cannot be found found at '^' position.
Page 33: Displaying
Huawei AR1200 Series Enterprise Routers Configuration Guide - Basic Configuration 2 CLI Overview Function Press Tab after typing a partial key word and the system runs partial help: l If the matching key word is unique, the system replaces the typed character string with a complete key word and displays it in a new line with the cursor placed at the end of the word.
Page 34 Huawei AR1200 Series Enterprise Routers Configuration Guide - Basic Configuration 2 CLI Overview Common characters Common characters, including all upper-case and lower-case letters, digits, punctuation marks, and special symbols, match themselves in a string. For example, "a" matches the letter "a" in "abc", "202" matches the digit "202" in "202.113.25.155", and "@" matches the symbol "@"...
Page 35 Huawei AR1200 Series Enterprise Routers Configuration Guide - Basic Configuration 2 CLI Overview Special Syntax Example characte [xyz] Matches any single character in the [123] matches the character 2 in regular expression. "255". [^xyz] Matches any character that is not [^123] matches any character except contained within the brackets.
Page 36: Previously-Used Commands
2 CLI Overview Specifying a Filtering Mode in a Command CAUTION The Huawei AR1200 Series uses a regular expression to implement the pipe character filtering function. A display command supports the pipe character only when there is excessive output information.
Page 37: Shortcut Keys
Huawei AR1200 Series Enterprise Routers Configuration Guide - Basic Configuration 2 CLI Overview Table 2-6 Access the previously-used commands Action Key or Command Result Display display history- Display previously-used commands entered by previously- command users. used commands. Access the last Up cursor key (↑) or...
Page 38: Defining Shortcut Keys
Huawei AR1200 Series Enterprise Routers Configuration Guide - Basic Configuration 2 CLI Overview NOTE Different terminal software defines these keys differently. The shortcut keys on your terminal may be different than those listed in this section. Table 2-7 System-defined shortcut keys...
Page 39: Use Of Shortcut Keys
Huawei AR1200 Series Enterprise Routers Configuration Guide - Basic Configuration 2 CLI Overview CTRL_G, CTRL_L and CTRL_O are assigned to run the following commands by default: CTRL_G: display current-configuration CTRL_L: undo idle-timeout CTRL_O: undo debugging all By default, CTRL_U is not assigned to any command.
Page 40 Huawei AR1200 Series Enterprise Routers Configuration Guide - Basic Configuration 2 CLI Overview Context You do not always need to input complete keywords. Instead, input one or more of the first characters of a keyword and press Tab to complete the keyword. The Tab key helps search for and use commands.
Page 41: Example For Using Shortcut Keys
When defining shortcut keys for a command, use double quotation marks to quote the command if the command consisting of multiple words, which are separated by spaces. No double quotation marks are required for single-word commands. Step 2 Press Ctrl_U when the prompt [Huawei] appears. [Huawei] display local-user ----------------------------------------------------------------------------...
Page 42: Basic Configuration
Huawei AR1200 Series Enterprise Routers Configuration Guide - Basic Configuration 3 Basic Configuration Basic Configuration About This Chapter This chapter describes how to configure the router to work properly in the network environment and to suit your needs. 3.1 Configuring the Basic System Environment This section describes how to configure the basic system environment.
Page 43: Configuring The Basic System Environment
Huawei AR1200 Series Enterprise Routers Configuration Guide - Basic Configuration 3 Basic Configuration 3.1 Configuring the Basic System Environment This section describes how to configure the basic system environment. 3.1.1 Establishing the Configuration Task Before configuring the basic system environment, familiarize yourself with the applicable environment, complete the pre-configuration tasks, and obtain any data required for the configuration.
Page 44: Setting The System Clock
Step 2 Run: sysname host-name The equipment name is set. By default, the equipment name of the router is Huawei. You can change the name of the router that appears in the command prompt. ----End 3.1.3 Setting the System Clock The system clock must be correctly set to ensure synchronization with other devices.
Page 45 Huawei AR1200 Series Enterprise Routers Configuration Guide - Basic Configuration 3 Basic Configuration second | third | fourth | last } weekday month | end-date } offset [ start-year [ end-year ] ] Daylight saving time is set. By default, daylight saving time is not set.
Page 46 Huawei AR1200 Series Enterprise Routers Configuration Guide - Basic Configuration 3 Basic Configuration Operation Configured System Example Time 1, 2 date-time +/- zone-offset Run the clock datetime 8:0:0 2011-11-12 and clock timezone BJ add 8 commands. Configured system time: 2011-11-12 16:00:13+08:00...
Page 47 Huawei AR1200 Series Enterprise Routers Configuration Guide - Basic Configuration 3 Basic Configuration Operation Configured System Example Time 1, 3 date-time if date-time is Run the clock datetime 9:0:0 2011-11-12 and not during the configured clock daylight-saving-time BJ one-year 6:0 daylight saving time 2012-8-1 6:0 2012-10-01 1 commands.
Page 48 Huawei AR1200 Series Enterprise Routers Configuration Guide - Basic Configuration 3 Basic Configuration Operation Configured System Example Time date-time if date-time is Run the clock daylight-saving-time BJ one-year during the configured 1:0 2011-1-1 1:0 2011-9-1 2 and clock datetime daylight saving time 3:0 2011-1-1 commands.
Page 49 Huawei AR1200 Series Enterprise Routers Configuration Guide - Basic Configuration 3 Basic Configuration Operation Configured System Example Time 1, 2, 3, or 1, date-time +/- zone-offset Run the clock datetime 8:0:0 2011-11-12, clock 3, 2 if the value of date-time...
Page 50: Configuring A Header
Huawei AR1200 Series Enterprise Routers Configuration Guide - Basic Configuration 3 Basic Configuration Operation Configured System Example Time date-time if date-time is Run the clock timezone BJ add 8, clock daylight- during the configured saving-time BJ one-year 1:0 2011-1-1 1:0...
Page 51: Configuring The Undo Command To Automatically Match The Higher-Level View
Huawei AR1200 Series Enterprise Routers Configuration Guide - Basic Configuration 3 Basic Configuration CAUTION l The header message starts and ends with the same character. Enter the first character of the header and press Enter. An interactive interface for setting the header is displayed. Input the required information and end the header by entering the first character when you are finished.
Page 52: Displaying System Configuration
Huawei AR1200 Series Enterprise Routers Configuration Guide - Basic Configuration 3 Basic Configuration Context You can use display commands to collect information about system status. The display commands perform the following functions: Display system configurations. Display system running status. Display diagnostic information about a system.
Page 53 Huawei AR1200 Series Enterprise Routers Configuration Guide - Basic Configuration 3 Basic Configuration Context If you cannot perform routine maintenance, you must run the various display commands to collect information needed to locate faults. The display diagnostic-information command gathers information about all system modules currently running.
Page 54: Configuring User Interfaces
Huawei AR1200 Series Enterprise Routers Configuration Guide - Basic Configuration 4 Configuring User Interfaces Configuring User Interfaces About This Chapter When a user logs in to the router by using the console port, Telnet, or SSH, the system manages the session between the user and the router on the corresponding user interface.
Page 55: User Interface Overview
Huawei AR1200 Series Enterprise Routers Configuration Guide - Basic Configuration 4 Configuring User Interfaces 4.1 User Interface Overview The system supports console and VTY user interfaces. Each user interface has a user interface view. A user interface view is a command line view provided by the system.
Page 56 Huawei AR1200 Series Enterprise Routers Configuration Guide - Basic Configuration 4 Configuring User Interfaces Table 4-1 Example for the absolute numbering Absolute number User-interface CON0 First TTY user interface (TTY1) Second TTY user interface (TTY2) Third TTY user interface (TTY3)
Page 57: Configuring The Console User Interface
Huawei AR1200 Series Enterprise Routers Configuration Guide - Basic Configuration 4 Configuring User Interfaces In the case of non-authentication or password authentication, the level of the command that the user can run is determined by the level of the user interface.
Page 58 Huawei AR1200 Series Enterprise Routers Configuration Guide - Basic Configuration 4 Configuring User Interfaces Context Physical attributes of a console port have default values on the router and no additional configuration is needed. NOTE When a user logs in to a router through a console port, the physical attributes set for the console port on the HyperTerminal must be consistent with the attributes of the console user interface on the router, or the user will not be able to log in.
Page 59: Setting Terminal Attributes Of The Console User Interface
Huawei AR1200 Series Enterprise Routers Configuration Guide - Basic Configuration 4 Configuring User Interfaces 4.2.3 Setting Terminal Attributes of the Console User Interface This section describes how to set terminal attributes of the console user interface, including the user timeout disconnection function, number of lines displayed in a terminal screen, and size of the history command buffer.
Page 60: Configuring User Privilege Of The Console User Interface
Huawei AR1200 Series Enterprise Routers Configuration Guide - Basic Configuration 4 Configuring User Interfaces 4.2.4 Configuring User Privilege of the Console User Interface This section describes how to control a user' authority to log in to the router and how to improve router security by configuring user priority.
Page 61 Huawei AR1200 Series Enterprise Routers Configuration Guide - Basic Configuration 4 Configuring User Interfaces Table 4-2 Authentication Modes Authen Advantage Disadvantage tication Mode AAA provides user authentication with high The configuration is complex. security. The user name and password for...
Page 62: Checking The Configuration
Huawei AR1200 Series Enterprise Routers Configuration Guide - Basic Configuration 4 Configuring User Interfaces Exit from the AAA view. Configuring password authentication Run: system-view The system view is displayed. Run: user-interface console interface-number The console user interface view is displayed.
Page 63: Configuring The Vty User Interface
Huawei AR1200 Series Enterprise Routers Configuration Guide - Basic Configuration 4 Configuring User Interfaces Example Run the display users command to view information about the current user interface. <Huawei> display users User-Intf Delay Type Network Address AuthenStatus AuthorcmdFlag CON 0...
Page 64: Configuring The Maximum Number Of Vty User Interfaces
Huawei AR1200 Series Enterprise Routers Configuration Guide - Basic Configuration 4 Configuring User Interfaces Logging in to the router by using a terminal Data Preparation To configure a VTY user interface, you need the following data. Data Maximum VTY user interfaces...
Page 65: Optional) Setting Restrictions For Incoming And Outgoing Calls On Vty User Interfaces
The user interface supports the basic ACL ranging from 2000 to 2999 and the advanced ACL ranging from 3000 to 3999. l For ACL configuration details, refer to the Configuration Guide - SecurityHuawei AR1200 Series Enterprise Routers Configuration Guide - Security.
Page 66: Setting User Priority Of The Vty User Interface
Huawei AR1200 Series Enterprise Routers Configuration Guide - Basic Configuration 4 Configuring User Interfaces Context Terminal attributes of a VTY user interface have default values on the router and you can set them as needed. Procedure Step 1 Run: system-view The system view is displayed.
Page 67: Setting The User Authentication Mode Of The Vty User Interface
Huawei AR1200 Series Enterprise Routers Configuration Guide - Basic Configuration 4 Configuring User Interfaces Context Users are classified into 16 levels (numbered 0 to 15). The greater the number, the higher the user level. This procedure sets the priority of a user who logs in through the console port. A user's level determines the level of commands the user is authorized to run.
Page 68 Huawei AR1200 Series Enterprise Routers Configuration Guide - Basic Configuration 4 Configuring User Interfaces Authen Advantage Disadvantage tication Mode Passwor Password authentication is based on VTY It provides lower security channels, providing security. The compared with AAA. authenti configuration is simple and only the login...
Page 69: Checking The Configuration
Huawei AR1200 Series Enterprise Routers Configuration Guide - Basic Configuration 4 Configuring User Interfaces The system view is displayed. Run: user-interface vty first-ui-number [ last-ui-number ] The VTY user interface view is displayed. Run: authentication-mode password The authentication mode is set to password authentication.
Page 70: Configuring A Tty User Interface
Huawei AR1200 Series Enterprise Routers Configuration Guide - Basic Configuration 4 Configuring User Interfaces <Huawei> display users User-Intf Delay Type Network Address AuthenStatus AuthorcmdFlag VTY 0 00:00:12 10.138.77.38 Username : Unspecified + 35 VTY 1 00:00:00 10.138.77.57 Username : Unspecified Run the display user-interface maximum-vty command to view the maximum number of VTY user interfaces.
Page 71: Setting Physical Attributes Of A Tty User Interface
Huawei AR1200 Series Enterprise Routers Configuration Guide - Basic Configuration 4 Configuring User Interfaces terminal attributes, and user priority. These parameters have default values that require no additional configuration , but you may modify these parameters as needed. Pre-configuration Tasks...
Page 72: Setting Terminal Attributes Of A Tty User Interface
Huawei AR1200 Series Enterprise Routers Configuration Guide - Basic Configuration 4 Configuring User Interfaces After a board is registered successfully and a serial port on the board is configured to work in asynchronous mode, the router generates a random TTY number for the asynchronous serial port.
Page 73: Configuring User Priority Of A Tty User Interface
Huawei AR1200 Series Enterprise Routers Configuration Guide - Basic Configuration 4 Configuring User Interfaces Step 3 Run: shell The terminal service is started. Step 4 Run: idle-timeout minutes [ seconds ] The idle timeout period is set. If the connection remains idle for the timeout period, the system automatically terminates the connection.
Page 74: Configuring The Authentication Mode On A Tty User Interface
Huawei AR1200 Series Enterprise Routers Configuration Guide - Basic Configuration 4 Configuring User Interfaces The TTY user interface view is displayed. Step 3 Run: user privilege level level The user priority is set. NOTE l By default, users logging in through the TTY user interface can use commands at level 3, and users logging in through other user interfaces can use commands at level 0.
Page 75: Checking The Configuration
Huawei AR1200 Series Enterprise Routers Configuration Guide - Basic Configuration 4 Configuring User Interfaces The TTY user interface view is displayed. Run: authentication-mode password The authentication mode is set to password authentication. Run: set authentication password { cipher | simple } password The authentication password is configured.
Page 76: Configuration Examples
Huawei AR1200 Series Enterprise Routers Configuration Guide - Basic Configuration 4 Configuring User Interfaces : Current UI is active. : Current UI is active and work in async mode. : Absolute index of UIs. Type : Type and relative index of UIs.
Page 77: Example For Configuring A Vty User Interface
Huawei AR1200 Series Enterprise Routers Configuration Guide - Basic Configuration 4 Configuring User Interfaces Data bit of the console user interface: 8 Timeout period for disconnecting from the console user interface: 30 minutes Number of lines that a terminal screen displays: 30...
Page 78 In the VTY user interface, the user priority is set to 15, the authentication mode is set to password authentication, with the password of "huawei", and a user with the IP address of 10.1.1.1 is prohibited from logging in to the router.
Page 79: Example For Configuring A Tty User Interface
Huawei AR1200 Series Enterprise Routers Configuration Guide - Basic Configuration 4 Configuring User Interfaces [Huawei] user-interface vty 0 14 [Huawei-ui-vty0-14] acl 2000 inbound Step 3 Set terminal attributes of the VTY user interface. [Huawei-ui-vty0-14] shell [Huawei-ui-vty0-14] idle-timeout 30 [Huawei-ui-vty0-14] screen-length 30 [Huawei-ui-vty0-14] history-command max-size 20 Step 4 Set the user priority of the VTY user interface.
Page 80 Huawei AR1200 Series Enterprise Routers Configuration Guide - Basic Configuration 4 Configuring User Interfaces NOTE By default, the terminal service is enabled on all user interfaces. If the terminal service is disabled, run the shell command to enable the terminal service.
Page 81: Configuring User Login
Huawei AR1200 Series Enterprise Routers Configuration Guide - Basic Configuration 5 Configuring User Login Configuring User Login About This Chapter A user can log in to the router through a console port, or by using Telnet or SSH (STelnet). The user can maintain the router locally or remotely after login.
Page 82: Overview Of User Login
Huawei AR1200 Series Enterprise Routers Configuration Guide - Basic Configuration 5 Configuring User Login 5.1 Overview of User Login A user must successfully log in to the device to manage and maintain it. The user can log in to the device using the console port, Telnet, or STelnet.
Page 83 Huawei AR1200 Series Enterprise Routers Configuration Guide - Basic Configuration 5 Configuring User Login Login Mode Applicable Scenario Remarks 5.3 Logging in to A user accesses the network By default, a user cannot log in to the Devices Using using a user terminal and device directly using Telnet.
Page 84: Logging In To The Devices Through The Console Port
Huawei AR1200 Series Enterprise Routers Configuration Guide - Basic Configuration 5 Configuring User Login Login Mode Applicable Scenario Remarks 5.4 Logging in to A user accesses the network By default, a user cannot log in to the Devices Using using a user terminal. If the device directly using STelnet.
Page 85: Logging In To The Device Using A Console Port
Huawei AR1200 Series Enterprise Routers Configuration Guide - Basic Configuration 5 Configuring User Login Applicable Environment A user can log in to a device locally through a console port. The user must log in through a console port when a router is powered on for the first time.
Page 86 Huawei AR1200 Series Enterprise Routers Configuration Guide - Basic Configuration 5 Configuring User Login Figure 5-1 Connection creation Step 2 Set an interface, as shown in Figure 5-2. Figure 5-2 Interface settings Step 3 Set communication parameters to match the router defaults, as shown in Figure 5-3.
Page 87: Optional) Configuring The Console User Interface
Configuration Guide - Basic Configuration 5 Configuring User Login Figure 5-3 Communication parameter settings Step 4 Press Enter. A command-line prompt such as <Huawei> appears, and the user view is displayed for you to configure the router. NOTE When you connect to the console port of a AR1200 that does not have a startup configuration file, the system displays "Auto-Config is working.
Page 88: Checking The Configuration
Huawei AR1200 Series Enterprise Routers Configuration Guide - Basic Configuration 5 Configuring User Login Context Console user interface attributes have default values on the device, and generally need no modification. To meet specific user requirements or ensure network security, you can modify console user interface attributes, such as terminal attributes and user authentication mode.
Page 89: Logging In To Devices Using Telnet
Huawei AR1200 Series Enterprise Routers Configuration Guide - Basic Configuration 5 Configuring User Login Run the display local-user command to view the local user list. <Huawei> display local-user ---------------------------------------------------------------------------- User-name State AuthMask AdminLevel ---------------------------------------------------------------------------- admin guest ---------------------------------------------------------------------------- Total 3 user(s) 5.3 Logging in to Devices Using Telnet...
Page 90: Configuring The User Access Level And User Authentication Mode Of The Vty User Interface
Huawei AR1200 Series Enterprise Routers Configuration Guide - Basic Configuration 5 Configuring User Login Data l User priority l User authentication mode, username, password l (Optional) Maximum number of VTY user interfaces allowed l (Optional) ACL to restrict incoming and outgoing calls on VTY user interfaces...
Page 91 Huawei AR1200 Series Enterprise Routers Configuration Guide - Basic Configuration 5 Configuring User Login Table 5-2 Association between user access levels and command levels User Level Description Name Visit This level gives access to commands that run network level diagnostic tools (such as ping and tracert) and commands that start from a local device and visit external devices (such as Telnet client side).
Page 92: Enabling The Telnet Service
Huawei AR1200 Series Enterprise Routers Configuration Guide - Basic Configuration 5 Configuring User Login The authentication mode is set to non-authentication. – Configuring Password Authentication Run: system-view The system view is displayed. Run: user-interface vty first-ui-number [ last-ui-number ] The VTY user interface view is displayed.
Page 93: Logging In To The Device Using Telnet
Huawei AR1200 Series Enterprise Routers Configuration Guide - Basic Configuration 5 Configuring User Login Context By default, the function of the Telnet server is enabled. Procedure Step 1 Run the following command as required. Step 2 For the IPv4 network...
Page 94: Checking The Configuration
5 Configuring User Login Figure 5-4 Windows CLI Press Enter to display the command line prompt, such as <HUAWEI>, for the system view. This indicates that you have accessed the Telnet server. If the password or AAA authentication mode has been set on the device, you must enter the login user name and password, and press Enter.
Page 95: Logging In To Devices Using Stelnet
Huawei AR1200 Series Enterprise Routers Configuration Guide - Basic Configuration 5 Configuring User Login Run the display tcp status command to check TCP connections. Run the display telnet server status command to check the configuration and status of the Telnet server.
Page 96: Configuring The User Access Level And User Authentication Mode Of The Vty User Interface
Huawei AR1200 Series Enterprise Routers Configuration Guide - Basic Configuration 5 Configuring User Login Pre-configuration Tasks Before configuring users to log in using STelnet, you must log in to the device through the console port to change the default configurations on the device, so that users can remotely log in to the device using Telnet to manage and maintain the device.
Page 97 Huawei AR1200 Series Enterprise Routers Configuration Guide - Basic Configuration 5 Configuring User Login Procedure Configure the user access level of the VTY user interface. Run: system-view The system view is displayed. Run: user-interface vty first-ui-number [ last-ui-number ] The VTY user interface view is displayed.
Page 98 Huawei AR1200 Series Enterprise Routers Configuration Guide - Basic Configuration 5 Configuring User Login NOTE l Different user access levels are associated with different command levels. A user at a certain access level can use only commands that have a level lower than or equal to the command level of the user.
Page 99: Configuring Ssh For The Vty User Interface
Huawei AR1200 Series Enterprise Routers Configuration Guide - Basic Configuration 5 Configuring User Login 5.4.3 Configuring SSH for the VTY User Interface For users to log in to the device using STelnet, VTY user interfaces must be configured to support SSH.
Page 100 Huawei AR1200 Series Enterprise Routers Configuration Guide - Basic Configuration 5 Configuring User Login authentication mode, configure both the server and the client to generate local RSA key pairs. NOTE Password-rsa authentication requires success of both password authentication and RSA authentication. The all authentication mode requires success of either password authentication or RSA authentication.
Page 101 Huawei AR1200 Series Enterprise Routers Configuration Guide - Basic Configuration 5 Configuring User Login The RSA authentication is configured for the SSH user. Run: rsa peer-public-key key-name The public key view is displayed. Run: public-key-code begin The public key editing view is displayed.
Page 102: Logging In To The Device Using Stelnet
Huawei AR1200 Series Enterprise Routers Configuration Guide - Basic Configuration 5 Configuring User Login The number of retry times of the SSH authentication is set. By default, the retry times is 3. ----End 5.4.5 Logging in to the Device Using STelnet...
Page 103: Optional) Configuring The Stelnet Server Parameters
SSH2.0 has an extended structure and supports more authentication modes compatibility and key exchange methods than SSH1.X. SSH2.0 also supports more advanced services such as SFTP. The Huawei AR1200 Series supports SSH versions ranging from 1.3 to 2.0. Interval for...
Page 104: Checking The Configuration
Huawei AR1200 Series Enterprise Routers Configuration Guide - Basic Configuration 5 Configuring User Login Server Operation Parameter Interval for Run the ssh server rekey-interval rekey-interval command. updating the By default, the interval is 0, indicating that the key pair is never updated.
Page 105: Common Operations After Login
Huawei AR1200 Series Enterprise Routers Configuration Guide - Basic Configuration 5 Configuring User Login Run the display ssh server session command. The command output shows that the session information between SSH server and client. <Huawei> display ssh server session --------------------------------------------------------------------...
Page 106: Locking User Interfaces
Huawei AR1200 Series Enterprise Routers Configuration Guide - Basic Configuration 5 Configuring User Login Context A password is required to increase user level. This prevents unauthorized users from gaining access to high-level commands. Procedure Step 1 Run: system-view The system view is displayed.
Page 107: Sending Messages To Other User Interfaces
Huawei AR1200 Series Enterprise Routers Configuration Guide - Basic Configuration 5 Configuring User Login Context The user interface can be a console user interface or a VTY user interface. Procedure Step 1 Run: lock The user interface is locked. Step 2 Step 2 Follow the system prompts and input a password to unlock the user interface.
Page 108: Configuration Examples
Huawei AR1200 Series Enterprise Routers Configuration Guide - Basic Configuration 5 Configuring User Login If all is configured, information about users logged in to all user interfaces is displayed. ----End 5.6 Configuration Examples This section provides several examples describing how to configure users to log in through a console port, Telnet, or STelnet.
Page 109 Huawei AR1200 Series Enterprise Routers Configuration Guide - Basic Configuration 5 Configuring User Login Figure 5-8 Connection creation Figure 5-9 Interface setting Issue 04 (2012-05-15) Huawei Proprietary and Confidential Copyright © Huawei Technologies Co., Ltd.
Page 110: Example For Logging In By Telnet
Step 3 Power on the router. After the self-check is complete and the router is started, you are prompted to press Enter. At the prompt (usually <Huawei>), you can run commands to view the status of the router or configure the router.
Page 111 Huawei AR1200 Series Enterprise Routers Configuration Guide - Basic Configuration 5 Configuring User Login Figure 5-11 Establishing the configuration environment over the WAN Eth1/0/0 202.38.160.92/16 Target Router Router Configuration Roadmap Establish the physical connection. Set user login parameters. Log in to the router from the client side.
Page 112: Example For Configuring User Login By Using Stelnet
Click OK. Enter the user name and password in the login window. After authentication, a command line prompt such as <Huawei> appears. Enter the configuration environment in the user view. ----End 5.6.3 Example for Configuring User Login by Using STelnet This part provides an example describing how to configure user login by using STelnet..
Page 113 [SSH Server-ui-vty0-4] quit NOTE If SSH is configured as the login protocol, the AR1200 automatically disables Telnet. Step 3 Configure the password of the SSH user Client001 to huawei. [SSH Server] aaa [SSH Server-aaa] local-user client001 password cipher huawei [SSH Server-aaa] local-user client001 privilege level 3...
Page 114 Huawei AR1200 Series Enterprise Routers Configuration Guide - Basic Configuration 5 Configuring User Login ----End Configuration Files Configuration file of the SSH server sysname SSH Server local-user client001 password cipher N`C55QK<`=/Q=^Q`MAF4<1!! local-user client001 privilege level 3 local-user client001 service-type ssh interface Ethernet1/0/0 ip address 10.137.217.223 255.255.0.0...
Page 115: Managing The File System
Huawei AR1200 Series Enterprise Routers Configuration Guide - Basic Configuration 6 Managing the File System Managing the File System About This Chapter The file system manages the files and directories on the storage devices of the router. It can move or delete a file or directory, or display the contents of a file.
Page 116: File System Overview
Huawei AR1200 Series Enterprise Routers Configuration Guide - Basic Configuration 6 Managing the File System 6.1 File System Overview The router uses the file system to manage all files. 6.1.1 File System The file system manages files and directories on the storage devices. It can create, delete, modify, or rename a file or directory, or display the contents of a file.
Page 117: Managing Files Using The File System
Huawei AR1200 Series Enterprise Routers Configuration Guide - Basic Configuration 6 Managing the File System FTP server: Users can use the FTP client program to log in to the device and operate files on the device. Before users log in, the network administrator must configure an IP address for the FTP server.
Page 118: Managing Storage Devices
The storage devices can be flash memory, or USB flash drives. The router has a built-in flash memory. The router provides two reserved USB slots (usb0 and usb1). Only Huawei-certified storage devices can be used. You can format a storage device if you are unable to repair the file system or do not need any data saved on the storage device.
Page 119: Managing Files
Huawei AR1200 Series Enterprise Routers Configuration Guide - Basic Configuration 6 Managing the File System Context You can manage directories by changing or displaying directories, displaying files in directories or sub-directories, and creating or deleting directories. Procedure Run: cd { directory | device-name } A directory is specified.
Page 120 Huawei AR1200 Series Enterprise Routers Configuration Guide - Basic Configuration 6 Managing the File System – The value configured by screen-length screen-length temporary command must be larger than 0. – The total number of lines in the file must be greater than the value configured by screen-length command.
Page 121: Managing Files Using Ftp
Huawei AR1200 Series Enterprise Routers Configuration Guide - Basic Configuration 6 Managing the File System Run: reset recycle-bin [ filename ] The file is deleted. You can use this command to permanently delete files in the recycle bin. Running Files in Batches You can process uploaded files in batches.
Page 122: Establishing The Configuration Task
Huawei AR1200 Series Enterprise Routers Configuration Guide - Basic Configuration 6 Managing the File System 6.3.1 Establishing the Configuration Task Before using FTP to manage files, familiarize yourself with the applicable environment, complete the pre-configuration tasks, and obtain any data required for the configuration. This will help you complete the configuration task quickly and correctly.
Page 123: Optional) Specifying A Port Number For The Ftp Server
Huawei AR1200 Series Enterprise Routers Configuration Guide - Basic Configuration 6 Managing the File System The default FTP working directory is configured. NOTE The configuration in this step takes effect only with TACACS users. Step 3 Run: The AAA view is displayed.
Page 124: Enabling The Ftp Server
Huawei AR1200 Series Enterprise Routers Configuration Guide - Basic Configuration 6 Managing the File System Once a new listening port number is configured, the FTP server interrupts all existing FTP connections and begins to use the new listening port. ----End 6.3.4 Enabling the FTP Server...
Page 125: Optional) Configuring An Ftp Acl
Huawei AR1200 Series Enterprise Routers Configuration Guide - Basic Configuration 6 Managing the File System ftp server-source { -a ip-address | -i interface-type interface-number } The source IP address and source interface of an FTP server is configured. To log in to the FTP server, you must specify the source IP address for the server in the ftp command, or you cannot log in to the FTP server.
Page 126: Accessing The System By Using Ftp
Huawei AR1200 Series Enterprise Routers Configuration Guide - Basic Configuration 6 Managing the File System Step 4 Run: quit The system view is displayed. Step 5 Run: ftp acl acl-number The basic FTP ACL is configured. ----End 6.3.7 Accessing the System by Using FTP After the FTP server is configured, you can use FTP to access the router from a PC and manage the files on the router.
Page 127: Managing Files Using Ftp Commands
Huawei AR1200 Series Enterprise Routers Configuration Guide - Basic Configuration 6 Managing the File System 6.3.8 Managing Files Using FTP Commands After logging in to the router that functions as an FTP server using FTP, you can upload and download files to and from the router, or manage the directories on the router.
Page 128: Checking The Configuration
Huawei AR1200 Series Enterprise Routers Configuration Guide - Basic Configuration 6 Managing the File System The specified directory of the FTP server is displayed. – Run: lcd [ local-directory ] The directory of the FTP client is displayed or changed.
Page 129: Managing Files Using Sftp
Huawei AR1200 Series Enterprise Routers Configuration Guide - Basic Configuration 6 Managing the File System Example After configuring the FTP server, run the display ftp-server command. You can view that the FTP server is working. <Huawei> display ftp-server FTP server is running...
Page 130: Configuring Vty User Interface
Huawei AR1200 Series Enterprise Routers Configuration Guide - Basic Configuration 6 Managing the File System Data Username, password, authentication mode, and service type of an SSH user, remote public RSA key pair allocated to the SSH user, and SFTP working directory of the...
Page 131: Configuring An Ssh User And Specifying Sftp As One Of Service Types
Huawei AR1200 Series Enterprise Routers Configuration Guide - Basic Configuration 6 Managing the File System The VTY user interface is displayed. Step 3 Run: authentication-mode aaa The AAA authentication mode is configured. Step 4 Run: protocol inbound ssh The VTY user interface is configured to support SSH.
Page 132 Huawei AR1200 Series Enterprise Routers Configuration Guide - Basic Configuration 6 Managing the File System Step 5 Run: rsa local-key-pair create A local RSA key pair is generated. NOTE l Before performing other SSH configurations, run the rsa local-key-pair create command to generate a local key pair.
Page 133: Enabling The Sftp Service
Huawei AR1200 Series Enterprise Routers Configuration Guide - Basic Configuration 6 Managing the File System l If the specified key-name is deleted in other views, the system prompts that the key does not exist after the peer-public-key end command is run and the system view is displayed.
Page 134: Accessing The System Using Sftp
Huawei AR1200 Series Enterprise Routers Configuration Guide - Basic Configuration 6 Managing the File System Context By default, the SFTP server function is not enabled on the router. You can use SFTP to establish connections with the router only after the SFTP server function is enabled on the router.
Page 135: Managing Files Using Sftp
Huawei AR1200 Series Enterprise Routers Configuration Guide - Basic Configuration 6 Managing the File System Figure 6-2 Using SFTP to log in to the device ----End 6.4.7 Managing Files Using SFTP You can log in to the SSH server from an SFTP client to create or delete directories on the SSH server.
Page 136: Checking The Configuration
Huawei AR1200 Series Enterprise Routers Configuration Guide - Basic Configuration 6 Managing the File System Perform one or multiple of the following operations as required. – Run: cd [ remote-directory ] The current operating directory of users is changed. – Run: The current operating directory of users is displayed.
Page 137: Configuration Examples
Huawei AR1200 Series Enterprise Routers Configuration Guide - Basic Configuration 6 Managing the File System Run the display ssh server status command on the SSH server to check its global configurations. Run the display ssh server session command on the SSH server to check information about connection sessions with SSH clients.
Page 138 Huawei AR1200 Series Enterprise Routers Configuration Guide - Basic Configuration 6 Managing the File System Networking Requirements You can log in to the router through the console port, Telnet, or STelnet to manage files on the router. The path to the file on the storage device must be entered correctly. If the user does not specify a target file name, the source file name is the name of the target file by default.
Page 139: Example For Performing File Operations By Means Of Ftp
Huawei AR1200 Series Enterprise Routers Configuration Guide - Basic Configuration 6 Managing the File System Step 3 Display the file information about the current directory to check that the file has been copied to the specified directory. <Huawei> dir Directory of flash:/...
Page 140 IP address of the FTP server, that is, 10.137.217.221 Timeout period for the FTP connection, that is, 20 minutes FTP username as huawei and password as huawei on the server Destination file name and its position in the FTP client Ensure that the PC can communicate with the FTP server.
Page 141: Example For Performing File Operations By Means Of Sftp
Huawei AR1200 Series Enterprise Routers Configuration Guide - Basic Configuration 6 Managing the File System Step 5 Upload and download files, as shown in the following figure. Figure 6-5 Performing file operations by means of FTP NOTE You can run the dir command before downloading a file or after uploading a file to view the detailed information of the file.
Page 142 Enable SFTP services on the SSH server and configure a user service type. Data Preparation To complete the configuration, you need the following data: SSH user authentication mode: password, user name: client001, password: huawei User level of client001: 3 IP address of the SSH server: 10.137.217.225 Procedure Step 1 Configure a local key pair on the SSH server.
Page 143 [SSH Server-ui-vty0-4] quit Step 3 Configure the SSH user name and password on the SSH server. [SSH Server] aaa [SSH Server-aaa] local-user client001 password cipher huawei [SSH Server-aaa] local-user client001 privilege level 3 [SSH Server-aaa] local-user client001 service-type ssh [SSH Server-aaa] local-user client001 ftp-directory flash: [SSH Server-aaa] quit Step 4 Enable SFTP.
Page 144 Huawei AR1200 Series Enterprise Routers Configuration Guide - Basic Configuration 6 Managing the File System local-user client001 ftp-directory flash: interface Ethernet1/0/0 ip address 10.137.217.225 255.255.0.0 sftp server enable user-interface vty 0 4 authentication-mode aaa protocol inbound ssh return Issue 04 (2012-05-15) Huawei Proprietary and Confidential Copyright ©...
Page 145: Configuring System Startup
Huawei AR1200 Series Enterprise Routers Configuration Guide - Basic Configuration 7 Configuring System Startup Configuring System Startup About This Chapter When the router is powered on, system software starts and configuration files are loaded. To ensure smooth running of the router, you need to manage system software and configuration files efficiently.
Page 146: System Startup Overview
Huawei AR1200 Series Enterprise Routers Configuration Guide - Basic Configuration 7 Configuring System Startup 7.1 System Startup Overview When the router is powered on, system software starts and configuration files are loaded. 7.1.1 System Software System software provides an operating system for the router. System software must be set up correctly for the router to run properly and provide services.
Page 147: Establishing The Configuration Task
Huawei AR1200 Series Enterprise Routers Configuration Guide - Basic Configuration 7 Configuring System Startup 7.2.1 Establishing the Configuration Task Before managing configuration files, familiarize yourself with the applicable environment, complete the pre-configuration tasks, and obtain any data required for the configuration. This will help you complete the configuration task quickly and correctly.
Page 148: Clearing A Configuration File
Huawei AR1200 Series Enterprise Routers Configuration Guide - Basic Configuration 7 Configuring System Startup – By default, the interval at which the system saves the configuration file is 0 seconds, indicating that the system does not save the configuration file automatically.
Page 149: Comparing Configuration Files
Huawei AR1200 Series Enterprise Routers Configuration Guide - Basic Configuration 7 Configuring System Startup 7.2.4 Comparing Configuration Files You can compare the current configuration with the initial configuration. Context Do as follows on the router: Procedure Step 1 Run: compare configuration [ configuration-file [ current-line-number save-line- number ] ] The current configuration is compared with the configuration file for next startup.
Page 150: Specifying A File For System Startup
Huawei AR1200 Series Enterprise Routers Configuration Guide - Basic Configuration 7 Configuring System Startup Run the display autosave configuration command to view configurations of the autosave function, including the status of the autosave function and time for autosave check. Run the display this command to view configurations in the current view.
Page 151: Configuring System Software For A Router To Load For The Next Startup
Huawei AR1200 Series Enterprise Routers Configuration Guide - Basic Configuration 7 Configuring System Startup 7.3.2 Configuring System Software for a router to Load for the Next Startup If you need to upgrade system software of a router, you can specify the router system software to be loaded at the next startup.
Page 152: Checking The Configuration
Huawei AR1200 Series Enterprise Routers Configuration Guide - Basic Configuration 7 Configuring System Startup 7.3.4 Checking the Configuration After specifying a configuration file for system startup, you can check the content of the configuration file and information about the files to be used at the next startup on the router.
Page 153 Huawei AR1200 Series Enterprise Routers Configuration Guide - Basic Configuration 7 Configuring System Startup Configuration Roadmap The configuration roadmap is as follows: Save the current configuration. Specify the configuration file to be loaded at the next startup of the router.
Page 154 Huawei AR1200 Series Enterprise Routers Configuration Guide - Basic Configuration 7 Configuring System Startup Startup saved-configuration file: flash:/iascfg.zip Next startup saved-configuration file: usb0:/arcfg.cfg Startup license file: null Next startup license file: null Startup patch package: null Next startup patch package:...
Page 155: Accessing Another Device
Huawei AR1200 Series Enterprise Routers Configuration Guide - Basic Configuration 8 Accessing Another Device Accessing Another Device About This Chapter To manage configurations or operate files of another device, you can access the device by using Telnet, STelnet, TFTP, FTP, or SFTP from the device that you have logged in to.
Page 156: Accessing Another Device
Huawei AR1200 Series Enterprise Routers Configuration Guide - Basic Configuration 8 Accessing Another Device 8.1 Accessing Another Device To manage configurations or use files on a device other than the device you are logged in to, you can use Telnet, FTP, TFTP, or SSH to access that device.
Page 157: Ftp Method
Huawei AR1200 Series Enterprise Routers Configuration Guide - Basic Configuration 8 Accessing Another Device is the client of Router B and Router B is the client of Router C. Figure 8-3 illustrates the usage of shortcut keys. Figure 8-3 Usage of Telnet shortcut keys...
Page 158: Tftp Method
Huawei AR1200 Series Enterprise Routers Configuration Guide - Basic Configuration 8 Accessing Another Device FTP can transmit files between hosts and it provides users with common FTP commands for file system management. That is, using an FTP client program not residing on the router, you can upload or download the files and access the directories on the router;...
Page 159: Logging In To Other Devices Using Telnet
Huawei AR1200 Series Enterprise Routers Configuration Guide - Basic Configuration 8 Accessing Another Device Telnet does not provide secure authentication and TCP transmits data in plain text. This creates security vulnerabilities. Denial of service (DOS) attacks, host IP address spoofing, and route spoofing also threaten system security.
Page 160: Optional) Configuring A Source Ip Address For A Telnet Client
Huawei AR1200 Series Enterprise Routers Configuration Guide - Basic Configuration 8 Accessing Another Device Applicable Environment Figure 8-4 Networking diagram for accessing another device from the device that you have logged in to Network Network RouterA RouterB As shown in Figure 8-4, you can use Telnet to log in to Router A from a PC.
Page 161: Logging In To Another Device By Using Telnet
Huawei AR1200 Series Enterprise Routers Configuration Guide - Basic Configuration 8 Accessing Another Device Procedure Step 1 Run: system-view The system view is displayed. Step 2 Run: telnet client-source { -a source-ip-address | -i interface-type interface-number } A source IP address of a Telnet client is configured.
Page 162: Logging In To Another Device Using Stelnet
Huawei AR1200 Series Enterprise Routers Configuration Guide - Basic Configuration 8 Accessing Another Device Example Run the display tcp status command to view the status of TCP connections. The Established status indicates that a TCP connection has been established. <Huawei> display tcp status...
Page 163: Configuring The First Successful Login To Another Device (Enabling The First-Time Authentication On The Ssh Client)
Huawei AR1200 Series Enterprise Routers Configuration Guide - Basic Configuration 8 Accessing Another Device Data IPv4 address or host name of the SSH server, number of the port monitored by the SSH server, preferred encryption algorithm for data from the SFTP client to the SSH...
Page 164: Configuring The First Successful Login To Another Device (Allocating An Public Key To The Ssh Server)
Huawei AR1200 Series Enterprise Routers Configuration Guide - Basic Configuration 8 Accessing Another Device 8.3.3 Configuring the First Successful Login to Another Device (Allocating an Public Key to the SSH Server) To configure the first successful login to another device on an SSH client, you must allocate an RSA public key to the SSH server before the login.
Page 165: Logging In To Another Device By Using Stelnet
Huawei AR1200 Series Enterprise Routers Configuration Guide - Basic Configuration 8 Accessing Another Device Step 6 Run: peer-public-key end Return to the system view from the public key view. Step 7 Run: ssh client servername assign rsa-key keyname The RSA public key is assigned to the SSH server...
Page 166: Accessing Files On Another Device Using Tftp
Huawei AR1200 Series Enterprise Routers Configuration Guide - Basic Configuration 8 Accessing Another Device Procedure Run the display ssh server status command to view the status of the SSH server. ----End Example Run the display ssh server status to view the status of the SSH server.
Page 167: Optional) Configuring A Source Ip Address For A Tftp Client
Huawei AR1200 Series Enterprise Routers Configuration Guide - Basic Configuration 8 Accessing Another Device 8.4.2 (Optional) Configuring a Source IP Address for a TFTP Client You can configure a source IP address for a TFTP client and then use the source IP address to set up a TFTP connection from the TFTP client to the server along a specific route.
Page 168: Downloading Files Using Tftp
Huawei AR1200 Series Enterprise Routers Configuration Guide - Basic Configuration 8 Accessing Another Device The system view is displayed. Step 2 Run: acl acl-number The ACL view is displayed. Step 3 Run: rule [ rule-id ] { deny | permit } [ { fragment | none-first-fragment } | source...
Page 169: Checking The Configuration
Huawei AR1200 Series Enterprise Routers Configuration Guide - Basic Configuration 8 Accessing Another Device Procedure Run: tftp [ -a source-ip-address | -i interface-type interface-number ] tftp- server [ public-net | vpn-instance vpn-instance-name ] put source-filename [ destination-filename ] The router is configured to upload files using TFTP.
Page 170: Optional) Configuring The Source Ip Address And Interface Of The Ftp Client
Huawei AR1200 Series Enterprise Routers Configuration Guide - Basic Configuration 8 Accessing Another Device Applicable Environment Before transmitting files between a client and a remote FTP server or managing directories on the server, you can configure the router that you have logged in to as an FTP client. You can then use FTP to access the FTP server for file transmission or directory management.
Page 171: Connecting To Other Devices By Using Ftp Commands
Huawei AR1200 Series Enterprise Routers Configuration Guide - Basic Configuration 8 Accessing Another Device Step 2 Run: ftp client-source { -a source-ip-address | -i interface-type interface-number } The source address of the FTP client is configured. After the source address of the FTP client is configured, you can run the display ftp-users command on the FTP server to check that the displayed source address of the FTP client is the same as the configured one.
Page 172 Huawei AR1200 Series Enterprise Routers Configuration Guide - Basic Configuration 8 Accessing Another Device Configure a data type for transmission files and a file transmission method. Check the online help about FTP commands in the FTP client view. Upload local files to the remote FTP server, or download files from the FTP server and save them locally.
Page 173 Huawei AR1200 Series Enterprise Routers Configuration Guide - Basic Configuration 8 Accessing Another Device Run one or more of the the following commands order to manage directories. – Run: cd pathname The working path of the remote FTP server is specified.
Page 174: Changing Login Users
Huawei AR1200 Series Enterprise Routers Configuration Guide - Basic Configuration 8 Accessing Another Device 8.5.5 Changing Login Users After logging in to an FTP server, you can change the username on the client and re-log in to the server with the new username.
Page 175: Checking The Configuration
Huawei AR1200 Series Enterprise Routers Configuration Guide - Basic Configuration 8 Accessing Another Device Return to the FTP view. ----End 8.5.7 Checking the Configuration After the configurations for accessing other devices using FTP are complete, you can view the source parameters configured on the FTP client.
Page 176: Optional) Configuring A Source Ip Address For An Sftp Client
Huawei AR1200 Series Enterprise Routers Configuration Guide - Basic Configuration 8 Accessing Another Device Data (Optional) Source address of the device that functions as the SFTP client (Optional) Name of the SSH server (Optional) Public key that is assigned by the client to the SSH server...
Page 177: Configuring The First Successful Login To Another Device (Allocating An Public Key To The Ssh Server)
Huawei AR1200 Series Enterprise Routers Configuration Guide - Basic Configuration 8 Accessing Another Device Context If first-time authentication on the SSH client is enabled, the SFTP client does not check the validity of the RSA public key when logging in to the SSH server for the first time. After the login, the system automatically allocates the RSA public key and saves it for authentication at next login.
Page 178: Connecting To Other Devices By Using Sftp
Huawei AR1200 Series Enterprise Routers Configuration Guide - Basic Configuration 8 Accessing Another Device The system view is displayed. Step 2 Run: rsa peer-public-key key-name The public key view is displayed. Step 3 Run: public-key-code begin The public key editing view is displayed.
Page 179: Managing Files Using Sftp Commands
Huawei AR1200 Series Enterprise Routers Configuration Guide - Basic Configuration 8 Accessing Another Device Context The command of enabling the SFTP client is similar to that of the STelnet. When accessing the SSH server, the SFTP can carry the source address and the name of the VPN instance and choose the key exchange algorithm, encrypted algorithm and HMAC algorithm, and configure the keepalive function.
Page 180: Checking The Configuration
Huawei AR1200 Series Enterprise Routers Configuration Guide - Basic Configuration 8 Accessing Another Device cdup The view is switched to a directory one level up. – Run: The current operating directory of users is displayed. – Run: dir [ -l -a ] [ path ] A list of files in the specified directory is displayed.
Page 181: Configuration Examples
Huawei AR1200 Series Enterprise Routers Configuration Guide - Basic Configuration 8 Accessing Another Device Procedure Run the display sftp-client command to check the source IP address of the SFTP client on the SSH client. ----End Example Run the display sftp-client command on the client to view the source parameters of the device functioning as an SFTP client.
Page 182 Huawei AR1200 Series Enterprise Routers Configuration Guide - Basic Configuration 8 Accessing Another Device Host address of Router B Authentication mode and password Telnet server port number User level 15 Procedure Step 1 Configure IP addresses. # Configure Router A.
Page 183: Example For Configuring The Device As The Stelnet Client To Connect To The Ssh Server
Huawei AR1200 Series Enterprise Routers Configuration Guide - Basic Configuration 8 Accessing Another Device through telnet again, wait for at least two minutes and then set the port again. Are you sure to continue?(y/n)[n]: y Step 5 Use the port number 1028 to log in to Router B from Router A using Telnet.
Page 184 Huawei AR1200 Series Enterprise Routers Configuration Guide - Basic Configuration 8 Accessing Another Device Configure Client001 with the password huawei and use the password authentication mode. Configure Client002, use the RSA authentication mode, and assign the public key RsaKey001 to this client.
Page 185 [SSH Server-aaa] quit [SSH Server] ssh user client001 authentication-type password l Create an SSH user named Client002. # Create an SSH user named Client002, set the password to huawei, and configure RSA authentication for the user. [SSH Server] aaa [SSH Server-aaa] local-user client002 password cipher huawei...
Page 186 Press CTRL+K to abort Connected to 10.164.39.222 ... Enter password: Enter the password huawei. The following information indicates that the login succeeded. Info: The max number of VTY users is 20, and the number of current VTY users on line is 6.
Page 187 Huawei AR1200 Series Enterprise Routers Configuration Guide - Basic Configuration 8 Accessing Another Device Info: The max number of VTY users is 20, and the number of current VTY users on line is 6. The current login time is 2010-09-06 11:42:42.
Page 188: Example For Configuring Tftp
Huawei AR1200 Series Enterprise Routers Configuration Guide - Basic Configuration 8 Accessing Another Device user-interface vty 0 4 authentication-mode aaa protocol inbound ssh return Configuration file of Client001 on SSH client sysname client001 interface Ethernet1/0/0 ip address 10.164.39.220 255.255.255.0 ssh client first-time enable...
Page 189 Huawei AR1200 Series Enterprise Routers Configuration Guide - Basic Configuration 8 Accessing Another Device Data Preparation To complete the configuration, you need the following data: The TFTP application installed on the TFTP server The path to the file on the TFTP server...
Page 190: Example For Connecting The Sftp Client To The Ssh Server
Huawei AR1200 Series Enterprise Routers Configuration Guide - Basic Configuration 8 Accessing Another Device -rw- Feb 11 2008 14:34:17 rsa_host_key.efs -rw- Feb 11 2008 14:35:10 rsa_server_key.efs -rw- 1,498 Apr 01 2011 09:49:37 iascfg.zip -rw- 525,337 Apr 01 2011 09:50:00 private-data.txt...
Page 191 [SSH Server-aaa] local-user client001 ftp-directory flash: [SSH Server-aaa] quit l Create an SSH user named Client002. # Create an SSH user named Client002, set the password to huawei, and configure RSA authentication for the user. [SSH Server] aaa [SSH Server-aaa] local-user client002 password cipher huawei...
Page 192 Huawei AR1200 Series Enterprise Routers Configuration Guide - Basic Configuration 8 Accessing Another Device Step 3 Configure the RSA public key on the server. # Generate a local key pair for Client002. <Huawei> system-view [Huawei] sysname client002 [client002] rsa local-key-pair create # Check the RSA public key of the client.
Page 193 Huawei AR1200 Series Enterprise Routers Configuration Guide - Basic Configuration 8 Accessing Another Device Step 6 Connect to the SSH server. # Enable initial authentication for use by the SSH client at first time logins. <Huawei> system-view [Huawei] sysname client001 [client001] ssh client first-time enable <Huawei>...
Page 194: Example For Authenticating Ssh Through Radius
Huawei AR1200 Series Enterprise Routers Configuration Guide - Basic Configuration 8 Accessing Another Device Configuration Files Configuration file of the SSH server. sysname SSH Server rsa peer-public-key rsakey001 public-key-code begin 3047 0240 C4989BF0 416DA8F2 2675910D 7F2997E8 5573A35D 0163FD4A FAC39A6E 0F45F325...
Page 195 Huawei AR1200 Series Enterprise Routers Configuration Guide - Basic Configuration 8 Accessing Another Device Networking Requirements When a RADIUS user is connected to an SSH server, the SSH server sends the username and password of the SSH client to the RADIUS server (compatible with the TACACS server) for authentication.
Page 196 Huawei AR1200 Series Enterprise Routers Configuration Guide - Basic Configuration 8 Accessing Another Device Procedure Step 1 Generate a local key pair on the SSH server. <Huawei> system-view [Huawei] rsa local-key-pair create The key name will be: Host The range of public key size is (512 ~ 2048).
Page 197 Step 3 Create SSH users. Create users ssh1@ssh.com and ssh2@ssh.com on the RADIUS server. Specify the NAS's IP address 10.164.39.222 and set the password to huawei. The NAS's IP address is the IP address of the SSH server connected to the RADIUS server.
Page 198 The server's public key will be saved with the name: 10.164.39.222. Please wait... Enter password: Enter the password huawei. The following information indicates that the login succeeds. Info: The max number of VTY users is 10, and the current number of VTY users on line is 2.
Page 199 Huawei AR1200 Series Enterprise Routers Configuration Guide - Basic Configuration 8 Accessing Another Device [Huawei] display ssh server session -------------------------------------------------------------------- Conn Encry State Auth-type Username -------------------------------------------------------------------- VTY 0 password ssh1@ssh.com VTY 1 ssh2@ssh.com -------------------------------------------------------------------- ----End Configuration Files Configuration file of the SSH server radius-server template ssh radius-server authentication 10.164.6.49 1812...
Page 200: Upgrade And Maintenance
Huawei AR1200 Series Enterprise Routers Configuration Guide - Basic Configuration 9 Upgrade and Maintenance Upgrade and Maintenance About This Chapter router upgrade and maintenance can optimize device performance, monitor device operation status, simplify operations, and reduce operating expenditure (OPEX). 9.1 Upgrade and Maintenance Overview Devices can be upgraded and maintained by activating GTL license files, upgrading system software, managing patches, monitoring CPU and memory usage, or restarting devices.
Page 201: Upgrade And Maintenance Overview
Huawei AR1200 Series Enterprise Routers Configuration Guide - Basic Configuration 9 Upgrade and Maintenance 9.1 Upgrade and Maintenance Overview Devices can be upgraded and maintained by activating GTL license files, upgrading system software, managing patches, monitoring CPU and memory usage, or restarting devices.
Page 202: Cpu And Memory Usage Thresholds
Huawei AR1200 Series Enterprise Routers Configuration Guide - Basic Configuration 9 Upgrade and Maintenance Figure 9-1 Patch status transition Upload and Run patch Patch Status: Patch Status: running none Delete patch 9.1.4 CPU and Memory Usage Thresholds Configuring CPU and memory usage thresholds allows system performance to be monitored.
Page 203 Huawei AR1200 Series Enterprise Routers Configuration Guide - Basic Configuration 9 Upgrade and Maintenance If you purchase a new device, you must also purchase a GTL license file to obtain authorization to use the service modules you require. After the GTL license file has been activated, the license-controlled service modules can be used.
Page 204: Uploading A Gtl License File
A user who wants to upgrade a GTL license must run the license revoke command to obtain an invalidation code, and then use this code to apply to Huawei for a new GTL license. This user also needs to load the new GTL license file to the main control board.
Page 205: Optional) Enabling The Emergency State Of The Gtl License Module
Huawei AR1200 Series Enterprise Routers Configuration Guide - Basic Configuration 9 Upgrade and Maintenance NOTE Apply to Huawei for a new GTL license by using the invalidation code. Run: license active file-name The GTL license is activated and you obtained permission.
Page 206: Upgrading System Software
License Serial No : LIC20110309010210 Creator : Huawei Technologies Co., Ltd. Created Time : 2011-03-09 19:36:14 Country : China Custom : R&D of Huawei Technologies Co., Ltd. Office : Shenzhen Feature name : ACCESS Authorize type : DEMO Expired date...
Page 207: Checking The System Before The Upgrade
Step 1 Prepare hardware as needed, for example, free up memory space to store new system software and related upgrade files. Step 2 Check whether a new GTL license file is required and, If so, obtain it from Huawei. NOTE l A new GTL License must be obtained when a device is upgraded to a new R version or V version.
Page 208: Downloading A System File
MPUs are working properly. Run the display health command in the user view and record the command output. If you cannot locate faults that have occurred during the upgrade, provide this information to Huawei technical personnel for troubleshooting.
Page 209 Huawei AR1200 Series Enterprise Routers Configuration Guide - Basic Configuration 9 Upgrade and Maintenance Run the local-user user-name service-type ftp command to set the service type of the local user to FTP. Run the local-user user-name ftp-directory directory command to specify an FTP working directory for the FTP user.
Page 210 Huawei AR1200 Series Enterprise Routers Configuration Guide - Basic Configuration 9 Upgrade and Maintenance NOTE If the size of the system file in the current directory on the router is different from that on the PC, an error may occur during file transfer. Upload the system file again.
Page 211 Huawei AR1200 Series Enterprise Routers Configuration Guide - Basic Configuration 9 Upgrade and Maintenance Figure 9-4 Configuring an FTP user Run the ftp host [ port-number ] command on the router to log in to the PC. NOTE Before downloading the system file from the PC, ensure that there is enough space on the router to store the system file.
Page 212 Huawei AR1200 Series Enterprise Routers Configuration Guide - Basic Configuration 9 Upgrade and Maintenance Figure 9-5 Running a TFTP server program on the PC Set Current Directory to the directory of the backup system file by clicking Browse, and place the system file to the specified directory. Set Server Interface to the IP address of the TFTP server.
Page 213 0xbfffdf0 (tRootTask): usbBulkDevInit() returned OK Press Ctrl+B to break auto startup ... Attached TCP/IP interface to teth1. NOTE l To access the BootROM menu, you must enter the initial password huawei after pressing Ctrl+B. Select choice 3 to enter the network menu.
Page 214: Specifying The System Software To Be Used At The Next Startup
Huawei AR1200 Series Enterprise Routers Configuration Guide - Basic Configuration 9 Upgrade and Maintenance ENTER = no change; '.' = clear; Ftp type File name : ar.cc Ethernet ip address : 192.168.200.174 Ethernet ip mask : ffffff00 Gateway ip address Ftp host ip address : 192.168.200.1...
Page 215: Configuring A Backup Startup File
Huawei AR1200 Series Enterprise Routers Configuration Guide - Basic Configuration 9 Upgrade and Maintenance The system software to be used at the next startup is specified for the MPU. Step 2 (Optional) If the upgraded system software needs a corresponding patch file, perform the...
Page 216: Restarting A Device
Huawei AR1200 Series Enterprise Routers Configuration Guide - Basic Configuration 9 Upgrade and Maintenance Procedure Step 1 Run: upgrade slot slot-id startup bootrom The BootROM is upgraded. Step 2 Run: reset slot slot-id The LPU is reset. After the LPU is reset, run the display version slot slot-id command to check whether the BootROM has been upgraded.
Page 217: Checking The Configuration
Huawei AR1200 Series Enterprise Routers Configuration Guide - Basic Configuration 9 Upgrade and Maintenance Context Before activating a GTL license file, run the dir *.dat command to check that the GTL license file has been uploaded to the flash:. Procedure...
Page 218: Managing Patches
Huawei AR1200 Series Enterprise Routers Configuration Guide - Basic Configuration 9 Upgrade and Maintenance 9.4 Managing Patches This section describes several operations related to patches. You can install patches to upgrade the system without interrupting services, specify a patch file to be used after the next startup, uninstall patches that do not meet system requirements, or delete the unwanted patches to release the memory of the patch area on the MPU.
Page 219: Specifying A Patch File To Be Used At The Next Startup
Huawei AR1200 Series Enterprise Routers Configuration Guide - Basic Configuration 9 Upgrade and Maintenance In addition, perform the following operations before patch installation: Upload a patch file to the master MPU. For details, see the contents of uploading and downloading files in Performing File Operations by Using FTP Commands.
Page 220: Checking The Configuration
Huawei AR1200 Series Enterprise Routers Configuration Guide - Basic Configuration 9 Upgrade and Maintenance Context Only one patch file can be run in the system during patch installation. Therefore, delete the running patch file from the patch area before loading and running a new patch file.
Page 221: Setting Cpu Usage Thresholds
Huawei AR1200 Series Enterprise Routers Configuration Guide - Basic Configuration 9 Upgrade and Maintenance Applicable Environment The CPU and memory are key parts of a device. Routing information and fast route algorithms can consume a large amount of CPU resources, affecting system performance. If resource usage is too great, the device is unable to process data in a timely manner, packets may be lost, or the system may break down.
Page 222: Setting A Memory Usage Threshold
Huawei AR1200 Series Enterprise Routers Configuration Guide - Basic Configuration 9 Upgrade and Maintenance NOTE By default, the alarm threshold for CPU usage is 80%, and the clear alarm threshold for CPU usage is 75%. ----End 9.5.3 Setting a Memory Usage Threshold Setting a memory usage threshold allows memory usage to be monitored.
Page 223 Huawei AR1200 Series Enterprise Routers Configuration Guide - Basic Configuration 9 Upgrade and Maintenance Run the display memory-usage thresholdcommand to check memory usage. ----End Example # Display the CPU usage of the MPU. The CPU usage is displayed in the CPU column.
Page 224 Huawei AR1200 Series Enterprise Routers Configuration Guide - Basic Configuration 9 Upgrade and Maintenance PDTT PDTTPDT timer task VTYD 180a11 VTYDVirtual terminal RSA RSA public-key algorithms GRSA GRSA AGNT AGNTSNMP agent task TRAP ec52e5 TRAPSNMP trap task AGT6 AGT6SNMP AGT6 task...
Page 225: Restarting The Device
Huawei AR1200 Series Enterprise Routers Configuration Guide - Basic Configuration 9 Upgrade and Maintenance 9.6 Restarting the Device After the system software of the router is upgraded, the router must be restarted for configurations to take effect. Restarting the router also prevents the system failure due to an excessive number of temporary files.
Page 226: Configuring The Device To Restart As Scheduled
Huawei AR1200 Series Enterprise Routers Configuration Guide - Basic Configuration 9 Upgrade and Maintenance Context CAUTION Using the reboot command is not recommended. It can cause transient service interruption. Procedure Run: reboot [ fast ] The router is restarted immediately.
Page 227: Configuration Examples
As shown in Figure 9-6, the system software of the cannot meet customer's requirements and needs to be upgraded. Huawei has provided related upgrade files for the customer to perform software upgrade on the. Figure 9-6 Networking diagram for upgrading system software Eth2/0/0 10.1.1.1/24...
Page 228 Specify FTP as the mode of uploading the system software, the device as the FTP server, user 1 as the user name, and huawei as the user password. Specify the system software and configuration file to be used at the next startup.
Page 229 Huawei AR1200 Series Enterprise Routers Configuration Guide - Basic Configuration 9 Upgrade and Maintenance 220 FTP server ready. User <10.1.1.1:<none>>:user1 331 Please specify the password. Password: 230 User logged in. Specify a directory and a file transfer mode on the FTP client to store the uploaded file.
Page 230 [Huawei] display version Huawei Versatile Routing Platform Software VRP (R) software, Version 5.90 (AR1200 V200R002C00) Copyright (C) 2000-2010 Huawei Technologies Co., LTD Huawei AR1220 Router uptime is 0 week, 0 day, 3 hours, 59 minutes BKP 0 version information: 1. PCB Version : AR01BAK1A VER.C...
Page 231 This section provides an example for installing a patch without interrupting services. Networking Requirements As shown in Figure 9-7, the performance of the device needs to be optimized. Huawei has provided a patch file for the customer to install. Figure 9-7 Networking diagram for installing a patch file Eth2/0/0 10.1.1.1/24...
Page 232 Huawei AR1200 Series Enterprise Routers Configuration Guide - Basic Configuration 9 Upgrade and Maintenance Patch operation succeeded Step 3 Verify the configuration. After the configuration is complete, run the display patch-information command to view information about the running patch. <Huawei> display patch-information...

Huawei AR1200 Series User Configuration Manual

About this Document

1 Logging in to the System for the First Time

151 CLI Overview

3 Basic Configuration

4 Configuring User Interfaces

5 Configuring User Login

6 Managing the File System

7 Configuring System Startup

8 Accessing Another Device

9 Upgrade and Maintenance

Quick Links

Related Manuals for Huawei AR1200 Series

Summary of Contents for Huawei AR1200 Series